A single web visit can turn a local OpenClaw agent into an attacker-controlled tool
On August 25, 2026, Oasis Security, now part of Cyera, disclosed a critical flaw in NVIDIA NemoClaw, the deployment wrapper for OpenClaw. The issue lets a malicious website hijack a local AI agent with a single visit.
The root cause is not a model bug. It is a deployment configuration.
NemoClaw tries to let the OpenShell sandbox reach the Ollama inference backend. To do that, it binds Ollama to 0.0.0.0:11434. That exposes the service to all network interfaces instead of local loopback only.
This setup disables Ollama’s built-in Host header validation, leaving CORS as the only defense. Because the API has no authentication, any device on the local network can reach the model server. A malicious webpage can reach it.
The result is a server that should stay private but is open to nearby devices and web-driven attacks. That turns a local assistant into a network attack surface.
DNS rebinding opens the door
Attackers use DNS rebinding to bypass the browser’s same-origin policy. Their domain first resolves to a remote server, then switches to 127.0.0.1. The browser treats requests as same-origin because security is tied to the hostname, not the IP.
Once inside, the attacker gets full unauthenticated API access. They can enumerate models, pull or push arbitrary ones, and delete existing models. Any LAN device can also hit the API directly without DNS rebinding.
The most severe impact is model-template poisoning. The attacker fetches the model’s Go text/template, injects hidden instructions, and re-uploads it. That template controls how every message is rendered into raw text before inference.
Unlike prompt injection, which affects one conversation, this poisoning is permanent. It survives reboots, reloads, and resets. It runs below guardrails and stays invisible to monitoring tools that watch prompts or outputs.
How it’s impacting Openclaw
When OpenClaw sends its own system prompt, the poisoned template appends attacker instructions to every system message. The client has no way to detect or prevent this.
This is why the attack is hard to spot. Malicious text is not a normal user prompt or visible output. It sits in the template layer.
The blast radius depends on what the agent can access: source control, cloud credentials, databases, and MCP servers. Controlling the agent means controlling its authorized tools and resources.
NVIDIA released NemoClaw v0.0.35 with a fix for macOS and Linux. The Windows and WSL path carries a warning instead, and a later loopback check does not apply to that platform path.
Fixes and immediate mitigations
If you manage these deployments, treat the local API like any other privileged service. First, verify the bind address, then restrict access, and do not assume loopback is protected by default.
Act fast: bind Ollama to 127.0.0.1 instead of 0.0.0.0 to remove LAN exposure. Also add authentication to the local API to close the unauthenticated access path.
Do you want to learn more about Openclaw Agents? CLICK HERE.